Contact us Buy Me a Coffee

Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Nightspire

| Active | RaaS

None

Victims

214

First Discovered

2025-03-12

victim

Last Discovered

2026-03-25

victim

Inactive Since

1

day

Avg Delay

9.1

days

Infostealer

9.1%

victims with domain

View Victims on World Map

View group statistics

Known Locations (12)

Favicon	Title	Type	Available	Last Visit	Server Info	FQDN
	NightSpire		No	2025-06-01 21:19:00		`nspireyzmvapgiwgtuoznlafqvlyz7ey6himtgn5bdvdcowfyto3yryd.onion`
	Index of /data		No	2025-06-01 21:19:06		`nspireyzmvapgiwgtuoznlafqvlyz7ey6himtgn5bdvdcowfyto3yryd.onion`
	NightSpire		No	2025-06-01 21:19:14		`nspireyzmvapgiwgtuoznlafqvlyz7ey6himtgn5bdvdcowfyto3yryd.onion`
	404 Not Found		Yes	2026-03-26 19:02:02	nginx	`a2lyiiaq4n74tlgz4fk3ft4akolapfrzk772dk24iq32cznjsmzpanqd.onion`
	NightSpire		No	2026-03-26 19:03:05	nginx	`a2lyiiaq4n74tlgz4fk3ft4akolapfrzk772dk24iq32cznjsmzpanqd.onion`
	RaaS Service Started \| NightSpire		No	2026-02-28 16:04:32		`nspirebcv4sy3yydtaercuut34hwc4fsxqqv4b4ye4xmo6qp3vxhulqd.onion`
	Database \| NightSpire		No	2026-02-28 16:04:49		`nspirebcv4sy3yydtaercuut34hwc4fsxqqv4b4ye4xmo6qp3vxhulqd.onion`
	RaaS Service Started \| NightSpire		No	2026-02-28 16:05:01		`nspiremkiq44zcxjbgvab4mdedyh2pzj5kzbmvftcugq3mczx3dqogid.onion`
	Database \| NightSpire		No	2026-02-28 16:05:12		`nspiremkiq44zcxjbgvab4mdedyh2pzj5kzbmvftcugq3mczx3dqogid.onion`
	Verify human - NightSpire		Yes	2026-03-26 18:32:11	nginx	`nspire7lugml7ybqyjaaxtsgrs4qn3fcon3lrjbih6wamttvdm5ke4qd.onion`
	RaaS Service Started		Yes	2026-03-26 18:33:40	nginx	`nspirep7orjq73k2x2fwh2mxgh74vm2now6cdbnnxjk2f5wn34bmdxad.onion`
	RaaS Service Started		Yes	2026-03-26 18:34:44	nginx	`nspirep7orjq73k2x2fwh2mxgh74vm2now6cdbnnxjk2f5wn34bmdxad.onion`

Target (Available)

Heatmap (Available)

Ransom Notes (3)

Tools Used (Available)

This information is provided by Ransomware-Tool-Matrix
Discovery	RMM Tools	Defense Evasion	Credential Theft	OffSec	Networking	LOLBAS	Exfiltration
Everything.exe placeholder	placeholder placeholder	placeholder placeholder	placeholder placeholder	placeholder placeholder	placeholder placeholder	placeholder placeholder	MEGA WinSCP

Vulnerabilities Exploited (0)

TTPs Matrix (13)

This information is provided by Crocodyli & Ransomware.live
Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Impact
Develop Capabilities	Exploit Public-Facing Application	Command and Scripting Interpreter	Create Account	Exploitation for Privilege Escalation	Masquerading	OS Credential Dumping	Network Service Discovery	Remote Services: Remote Desktop Protocol	Automated Collection	Exfiltration Over Alternative Protocol	Application Layer Protocol	Data Encrypted for Impact
	Valid Accounts	Software Deployment Tools	Boot or Logon Autostart Execution		System Binary Proxy Execution	OS Credential Dumping: LSASS Memory	Process Discovery	Remote Services: SMB/Windows Admin Shares	Archive Collected Data	Exfiltration Over Web Service: Exfiltration to Cloud Storage	Encrypted Channel
	Brute Force		Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder		Obfuscated Files or Information	Unsecured Credentials	System Information Discovery	Windows Management Instrumentation	Archive Collected Data: Archive via Utility	Exfiltration Over C2 Channel
	Phishing		Scheduled Task/Job		Indicator Removal		File and Directory Discovery

Negotiation Chats (11)

YARA Rules (0)

Indicators of Compromise (IoCs) (9)

EMAIL 4 SHA256 2 TELEGRAM 2 TOX 1

Type	IOC
`email`	`night.spire.team@gmail.com`
`email`	`night.spire.team@onionmail.org`
`email`	`night.spire.team@proton.me`
`email`	`nightspireteam.receiver@onionmail.org`
`sha256`	`35cefe4bc4a98ad73dda4444c700aac9`
`sha256`	`f749efde8f9de6a643a57a5b605bd4e7`
`telegram`	`https://t.me/night_spire_team`
`telegram`	`@nightspireteam2025`
`tox`	`8D663FD10BF662930F4C076CBF95FACFCC4ABD8F1A5E328DE75D0B0237A74E1AE1E0C5C37E7F`

Victims (214)